Is CVE-2026-49976 exploited in the wild?

No. Junglewise Threat Intelligence has no report of CVE-2026-49976 being exploited in the wild.

How severe is CVE-2026-49976?

Medium severity, with a CVSS score of 6.5, published 19 August 2026.

Which products and versions are affected?

snipe/snipe-it (Packagist) < 8.6.0, ECOSYSTEM:introduced=0,fixed=8.6.0.

Is there a fix for CVE-2026-49976?

Yes. snipe/snipe-it (Packagist): upgrade to 8.6.0 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

How is CVE-2026-49976 attacked?

It is attacked over the network, in a network appliance.

Am I affected by CVE-2026-49976?

Check whether you run snipe/snipe-it (Packagist) or Snipeitapp Snipe-It at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

CVE-2026-49976: Snipe-IT privilege escalation via CSV import bypass

Q: Is there a fix for CVE-2026-49976?

Yes. snipe/snipe-it (Packagist): upgrade to 8.6.0 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

Q: How is CVE-2026-49976 attacked?

It is attacked over the network, in a network appliance.

Q: Am I affected by CVE-2026-49976?

Check whether you run snipe/snipe-it (Packagist) or Snipeitapp Snipe-It at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

CVE-2026-49976 · Severity: medium · CVSS 6.5 · Published 2026-08-19

Snipe-IT, an open-source IT asset management system, contains a vulnerability that allows users with data import permissions to take over other user accounts. By uploading a specially crafted CSV file, an authorized importer can change the email address associated with another account and then use the password reset feature to gain full access. This could lead to unauthorized access to sensitive asset data and administrative functions.

Technologies: snipe/snipe-it (Packagist), Snipeitapp Snipe-It. Vendors: Packagist, Snipeitapp.

Quick answers

Is CVE-2026-49976 exploited in the wild?: No. Junglewise Threat Intelligence has no report of CVE-2026-49976 being exploited in the wild.
How severe is CVE-2026-49976?: Medium severity, with a CVSS score of 6.5, published 19 August 2026.
Which products and versions are affected?: snipe/snipe-it (Packagist) < 8.6.0, ECOSYSTEM:introduced=0,fixed=8.6.0.
Is there a fix for CVE-2026-49976?: Yes. snipe/snipe-it (Packagist): upgrade to 8.6.0 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
How is CVE-2026-49976 attacked?: It is attacked over the network, in a network appliance.
Am I affected by CVE-2026-49976?: Check whether you run snipe/snipe-it (Packagist) or Snipeitapp Snipe-It at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

How to fix

snipe/snipe-it (Packagist): upgrade to 8.6.0 or later
```
composer require snipe/snipe-it:^8.6.0
```

Technical details

A missing authorization check in the CSV user import functionality (specifically in 'update' mode) allows for privilege escalation. While 'UserImporter.php' attempts to strip sensitive authentication fields using a gate check, the 'sanitizeItemForUpdating' method in 'ItemImporter.php' bypasses these unsets by rebuilding the update array directly from the raw CSV input. Consequently, an attacker with 'import' permissions can overwrite the email address of any non-admin user. Once the email is changed, the attacker can initiate a standard password reset flow to hijack the target account. This bypasses the stricter authorization logic found in the standard User API. The issue is fixed in version 8.6.0.

Affected products

Grokability Snipe-IT < 8.6.0

Identifiers

CVE-2026-49976
GHSA-p68w-rgmg-3c2v

Timeline

2026-06-08: disclosed
2026-06-23: advisory
2026-06-23: patched: Fixed in version 8.6.0

References

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.